ci.yaml

# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
#
# Generated on 2025-02-15T06:21:12Z by kres 8a48729.

name: default
concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
"on":
  push:
    branches:
      - main
      - release-*
    tags:
      - v*
  pull_request:
    branches:
      - main
      - release-*
jobs:
  default:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/')) && github.event_name == 'pull_request'
    outputs:
      labels: ${{ steps.retrieve-pr-labels.outputs.result }}
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: ci-temp-release-tag
        run: |
          make ci-temp-release-tag
      - name: external-artifacts
        run: |
          make external-artifacts
      - name: generate
        run: |
          make generate docs
      - name: uki-certs
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: check-dirty
        run: |
          make check-dirty
      - name: build
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64,linux/arm64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: lint
        run: |
          make lint
      - name: talosctl-cni-bundle
        run: |
          make talosctl-cni-bundle
      - name: iso
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make iso secureboot-iso
      - name: images-essential
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make images-essential
      - name: unit-tests
        run: |
          make unit-tests
      - name: unit-tests-race
        run: |
          make unit-tests-race
      - name: coverage
        uses: codecov/codecov-action@v5
        with:
          files: _out/coverage.txt
          token: ${{ secrets.CODECOV_TOKEN }}
        timeout-minutes: 3
      - name: Generate executable list
        run: |
          find _out -type f -executable > _out/executable-artifacts
      - name: save artifacts
        uses: actions/upload-artifact@v4
        with:
          name: talos-artifacts
          path: |-
            _out
            !_out/coverage.txt
          retention-days: "5"
      - name: Retrieve PR labels
        id: retrieve-pr-labels
        uses: actions/github-script@v7
        with:
          retries: "3"
          script: |
            if (context.eventName != "pull_request") { return "[]" }

            const resp = await github.rest.issues.get({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
            })

            return resp.data.labels.map(label => label.name)
  e2e-docker-short:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        run: |
          make ci-temp-release-tag
      - name: e2e-docker
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
        run: |
          make e2e-docker
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-e2e-docker-short
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  e2e-iso:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        run: |
          make ci-temp-release-tag
      - name: e2e-iso
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          sudo -E make e2e-iso
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-e2e-iso
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  e2e-qemu-short:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        run: |
          make ci-temp-release-tag
      - name: e2e-qemu
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-short
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-e2e-qemu-short
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-aws:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - generic
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Mask secrets
        run: |
          echo "$(sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | "::add-mask::" + .value')"
      - name: Set secrets for job
        run: |
          sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: e2e-aws-prepare
        env:
          E2E_AWS_TARGET: default
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make e2e-aws-prepare
      - name: checkout contrib
        uses: actions/checkout@v4
        with:
          path: _out/contrib
          ref: main
          repository: siderolabs/contrib
      - name: setup tf
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: "false"
      - name: tf apply
        env:
          TF_E2E_ACTION: apply
          TF_E2E_TEST_TYPE: aws
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
      - name: e2e-aws
        run: |
          make e2e-aws
      - name: tf destroy
        if: always()
        env:
          TF_E2E_ACTION: destroy
          TF_E2E_TEST_TYPE: aws
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
  integration-aws-nvidia-nonfree:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - generic
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-nonfree')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Mask secrets
        run: |
          echo "$(sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | "::add-mask::" + .value')"
      - name: Set secrets for job
        run: |
          sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: generate
        if: github.event_name == 'schedule'
        run: |
          make generate
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: checkout extensions
        uses: actions/checkout@v4
        with:
          path: _out/extensions
          ref: main
          repository: siderolabs/extensions
      - name: set variables
        run: |
          cat _out/talos-metadata >> "$GITHUB_ENV"
      - name: build extensions
        env:
          PLATFORM: linux/amd64
          PUSH: "true"
          REGISTRY: registry.dev.siderolabs.io
        run: |
          make nvidia-container-toolkit-lts nonfree-kmod-nvidia-lts extensions-metadata -C _out/extensions
      - name: e2e-aws-prepare
        env:
          E2E_AWS_TARGET: nvidia-nonfree
          EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make e2e-aws-prepare
      - name: checkout contrib
        uses: actions/checkout@v4
        with:
          path: _out/contrib
          ref: main
          repository: siderolabs/contrib
      - name: setup tf
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: "false"
      - name: tf apply
        env:
          TF_E2E_ACTION: apply
          TF_E2E_TEST_TYPE: aws
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
      - name: e2e-aws-nvidia-nonfree
        env:
          EXTRA_TEST_ARGS: -talos.extensions.nvidia
          TEST_NUM_NODES: "4"
        run: |
          make e2e-aws
      - name: tf destroy
        if: always()
        env:
          TF_E2E_ACTION: destroy
          TF_E2E_TEST_TYPE: aws
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
  integration-aws-nvidia-oss:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - generic
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/aws-nvidia-oss')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Mask secrets
        run: |
          echo "$(sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | "::add-mask::" + .value')"
      - name: Set secrets for job
        run: |
          sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: generate
        if: github.event_name == 'schedule'
        run: |
          make generate
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: checkout extensions
        uses: actions/checkout@v4
        with:
          path: _out/extensions
          ref: main
          repository: siderolabs/extensions
      - name: set variables
        run: |
          cat _out/talos-metadata >> "$GITHUB_ENV"
      - name: build extensions
        env:
          PLATFORM: linux/amd64
          PUSH: "true"
          REGISTRY: registry.dev.siderolabs.io
        run: |
          make nvidia-container-toolkit-production nvidia-open-gpu-kernel-modules-production zfs extensions-metadata -C _out/extensions
      - name: e2e-aws-prepare
        env:
          E2E_AWS_TARGET: nvidia-oss
          EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make e2e-aws-prepare
      - name: checkout contrib
        uses: actions/checkout@v4
        with:
          path: _out/contrib
          ref: main
          repository: siderolabs/contrib
      - name: setup tf
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: "false"
      - name: tf apply
        env:
          TF_E2E_ACTION: apply
          TF_E2E_TEST_TYPE: aws
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
      - name: e2e-aws-nvidia-oss
        env:
          EXTRA_TEST_ARGS: -talos.extensions.nvidia
          TEST_NUM_NODES: "4"
        run: |
          make e2e-aws
      - name: tf destroy
        if: always()
        env:
          TF_E2E_ACTION: destroy
          TF_E2E_TEST_TYPE: aws
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
  integration-azure:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - generic
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/azure')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Mask secrets
        run: |
          echo "$(sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | "::add-mask::" + .value')"
      - name: Set secrets for job
        run: |
          sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: e2e-azure-prepare
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make e2e-azure-prepare
      - name: checkout contrib
        uses: actions/checkout@v4
        with:
          path: _out/contrib
          ref: main
          repository: siderolabs/contrib
      - name: setup tf
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: "false"
      - name: tf apply
        env:
          ARM_CLIENT_ID: ${{ env.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ env.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ env.AZURE_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ env.AZURE_TENANT_ID }}
          TF_E2E_ACTION: apply
          TF_E2E_TEST_TYPE: azure
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
      - name: e2e-azure
        run: |
          make e2e-azure
      - name: tf destroy
        if: always()
        env:
          ARM_CLIENT_ID: ${{ env.AZURE_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ env.AZURE_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ env.AZURE_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ env.AZURE_TENANT_ID }}
          TF_E2E_ACTION: destroy
          TF_E2E_TEST_TYPE: azure
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
  integration-cilium:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/cilium')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-cilium
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-cilium
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH: '@hack/test/patches/cilium-no-kubeproxy.yaml'
          WITH_CUSTOM_CNI: cilium
          WITH_FIREWALL: accept
          WITH_SKIP_K8S_NODE_READINESS_CHECK: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-cilium-strict
        env:
          CILIUM_INSTALL_TYPE: strict
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-cilium-strict
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH: '@hack/test/patches/cilium-kubeproxy.yaml'
          WITH_CUSTOM_CNI: cilium
          WITH_FIREWALL: accept
          WITH_SKIP_K8S_NODE_READINESS_CHECK: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-cilium-strict-kubespan
        env:
          CILIUM_INSTALL_TYPE: strict
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-cilium-strict-kubespan
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH: '@hack/test/patches/cilium-kubeproxy.yaml'
          WITH_CUSTOM_CNI: cilium
          WITH_FIREWALL: accept
          WITH_KUBESPAN: "true"
          WITH_SKIP_K8S_NODE_READINESS_CHECK: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-cilium
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-cloud-images:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - generic
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/cloud-images')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Mask secrets
        run: |
          echo "$(sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | "::add-mask::" + .value')"
      - name: Set secrets for job
        run: |
          sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: images
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make images
      - name: cloud-images
        run: |
          make cloud-images
  integration-conformance:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/conformance')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: conformance-qemu
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-conformance-qemu
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_CPUS: "4"
          TEST_MODE: fast-conformance
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-qemu
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-extensions:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/extensions')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: generate
        if: github.event_name == 'schedule'
        run: |
          make generate
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: checkout extensions
        uses: actions/checkout@v4
        with:
          path: _out/extensions
          ref: main
          repository: siderolabs/extensions
      - name: unshallow-extensions
        run: |
          git -C _out/extensions fetch --prune --unshallow
      - name: set variables
        run: |
          cat _out/talos-metadata >> "$GITHUB_ENV"
      - name: build extensions
        env:
          PLATFORM: linux/amd64
          PUSH: "true"
          REGISTRY: registry.dev.siderolabs.io
        run: |
          make all extensions-metadata -C _out/extensions
      - name: installer extensions
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make installer-with-extensions
      - name: e2e-extensions
        env:
          EXTRA_TEST_ARGS: -talos.extensions.qemu
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-extensions
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_EXTRA_DISKS: "3"
          QEMU_MEMORY_WORKERS: "4096"
          QEMU_WORKERS: "1"
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH_WORKER: '@_out/installer-extensions-patch.yaml:@hack/test/patches/extensions.yaml:@hack/test/patches/dm-raid-module.yaml'
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-extensions
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-gcp:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - generic
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/gcp')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Mask secrets
        run: |
          echo "$(sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | "::add-mask::" + .value')"
      - name: Set secrets for job
        run: |
          sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: e2e-gcp-prepare
        run: |
          make e2e-gcp-prepare
      - name: checkout contrib
        uses: actions/checkout@v4
        with:
          path: _out/contrib
          ref: main
          repository: siderolabs/contrib
      - name: setup tf
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: "false"
      - name: tf apply
        env:
          TF_E2E_ACTION: apply
          TF_E2E_TEST_TYPE: gcp
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
      - name: e2e-gcp
        run: |
          make e2e-gcp
      - name: tf destroy
        if: always()
        env:
          TF_E2E_ACTION: destroy
          TF_E2E_TEST_TYPE: gcp
          TF_SCRIPT_DIR: _out/contrib
        run: |
          make e2e-cloud-tf
  integration-image-cache:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/image-cache')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: image-cache
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64,linux/arm64
          PUSH: "true"
        run: |
          make cache-create
      - name: e2e-image-cache
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-image-cache
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          REGISTRY_MIRROR_FLAGS: "no"
          SHORT_INTEGRATION_TEST: "yes"
          VIA_MAINTENANCE_MODE: "true"
          WITH_CONFIG_PATCH: '@hack/test/patches/image-cache.yaml'
          WITH_ISO: "true"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-image-cache
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-image-factory:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/image-factory')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64,linux/arm64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: iso
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
        run: |
          make iso secureboot-iso
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: factory-1.7-iso
        env:
          FACTORY_BOOT_METHOD: iso
          FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
          FACTORY_UPGRADE: "true"
          FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
          FACTORY_UPGRADE_VERSION: v1.7.6
          FACTORY_VERSION: v1.7.5
          GITHUB_STEP_NAME: ${{ github.job}}-factory-1.7-iso
          KUBERNETES_VERSION: 1.30.1
        run: |
          sudo -E make e2e-image-factory
      - name: factory-1.7-image
        env:
          FACTORY_BOOT_METHOD: disk-image
          FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
          FACTORY_UPGRADE: "true"
          FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
          FACTORY_UPGRADE_VERSION: v1.7.6
          FACTORY_VERSION: v1.7.5
          GITHUB_STEP_NAME: ${{ github.job}}-factory-1.7-image
          KUBERNETES_VERSION: 1.30.1
        run: |
          sudo -E make e2e-image-factory
      - name: factory-1.7-pxe
        env:
          FACTORY_BOOT_METHOD: pxe
          FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
          FACTORY_VERSION: v1.7.6
          GITHUB_STEP_NAME: ${{ github.job}}-factory-1.7-pxe
          KUBERNETES_VERSION: 1.30.1
        run: |
          sudo -E make e2e-image-factory
      - name: factory-1.7-secureboot
        env:
          FACTORY_BOOT_METHOD: secureboot-iso
          FACTORY_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
          FACTORY_UPGRADE: "true"
          FACTORY_UPGRADE_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
          FACTORY_UPGRADE_VERSION: v1.7.6
          FACTORY_VERSION: v1.7.5
          GITHUB_STEP_NAME: ${{ github.job}}-factory-1.7-secureboot
          KUBERNETES_VERSION: 1.30.1
        run: |
          sudo -E make e2e-image-factory
      - name: factory-1.6-secureboot
        env:
          FACTORY_BOOT_METHOD: secureboot-iso
          FACTORY_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
          FACTORY_UPGRADE: "true"
          FACTORY_UPGRADE_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
          FACTORY_UPGRADE_VERSION: v1.6.1
          FACTORY_VERSION: v1.6.0
          GITHUB_STEP_NAME: ${{ github.job}}-factory-1.6-secureboot
          KUBERNETES_VERSION: 1.29.0
        run: |
          sudo -E make e2e-image-factory
      - name: factory-1.6-iso
        env:
          FACTORY_BOOT_METHOD: iso
          FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
          FACTORY_UPGRADE: "true"
          FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
          FACTORY_UPGRADE_VERSION: v1.6.1
          FACTORY_VERSION: v1.6.0
          GITHUB_STEP_NAME: ${{ github.job}}-factory-1.6-iso
          KUBERNETES_VERSION: 1.29.0
        run: |
          sudo -E make e2e-image-factory
      - name: factory-1.5-iso
        env:
          FACTORY_BOOT_METHOD: iso
          FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
          FACTORY_UPGRADE: "true"
          FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
          FACTORY_UPGRADE_VERSION: v1.5.5
          FACTORY_VERSION: v1.5.5
          GITHUB_STEP_NAME: ${{ github.job}}-factory-1.5-iso
          KUBERNETES_VERSION: 1.28.5
        run: |
          sudo -E make e2e-image-factory
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-image-factory
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-images:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - generic
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/images')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: images
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make images
  integration-misc-0:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') || contains(fromJSON(needs.default.outputs.labels), 'integration/misc-0')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: image-metal-uki
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
        run: |
          make image-metal-uki
      - name: e2e-firewall
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-firewall
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_FIREWALL: block
        run: |
          sudo -E make e2e-qemu
      - name: e2e-canal-reset
        env:
          CUSTOM_CNI_URL: https://raw.githubusercontent.com/projectcalico/calico/v3.25.0/manifests/canal.yaml
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-canal-reset
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          INTEGRATION_TEST_RUN: TestIntegration/api.ResetSuite/TestResetWithSpec
        run: |
          sudo -E make e2e-qemu
      - name: e2e-controlplane-port
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-controlplane-port
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH: '@hack/test/patches/ephemeral-min-max.yaml'
          WITH_CONTROL_PLANE_PORT: "443"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-uki-4k
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-uki-4k
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_4K_DISK: "true"
          WITH_UKI_BOOT: "true"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-misc-0
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-misc-1:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') || contains(fromJSON(needs.default.outputs.labels), 'integration/misc-1')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-no-cluster-discovery
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-no-cluster-discovery
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CLUSTER_DISCOVERY: "false"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-kubespan
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-kubespan
          IMAGE_REGISTRY: registry.dev.siderolabs.io\
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CLUSTER_DISCOVERY: "true"
          WITH_KUBESPAN: "true"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-default-hostname
        env:
          DISABLE_DHCP_HOSTNAME: "true"
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-default-hostname
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          VIA_MAINTENANCE_MODE: "true"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-min-requirements
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-min-requirements
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_MEMORY_CONTROLPLANES: "2048"
          QEMU_MEMORY_WORKERS: "1024"
          QEMU_SYSTEM_DISK_SIZE: "10240"
          SHORT_INTEGRATION_TEST: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-misc-1
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-misc-2:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') || contains(fromJSON(needs.default.outputs.labels), 'integration/misc-2')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: iso
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make iso
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: e2e-bios
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-bios
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_UEFI: "false"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-bios-iso
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-bios-iso
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          VIA_MAINTENANCE_MODE: "true"
          WITH_ISO: "true"
          WITH_UEFI: "false"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-disk-image
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-disk-image
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          USE_DISK_IMAGE: "true"
          VIA_MAINTENANCE_MODE: "true"
          WITH_DISK_ENCRYPTION: "true"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-node-address-v2
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-disk-image
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH: '@hack/test/patches/node-address-v2.yaml'
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-misc-2
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-misc-3:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') || contains(fromJSON(needs.default.outputs.labels), 'integration/misc-3')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-network-chaos
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-network-chaos
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_NETWORK_CHAOS: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-metal-iso
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-metal-iso
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_INJECTION_METHOD: metal-iso
        run: |
          sudo -E make e2e-qemu
      - name: e2e-iommu-pcidriverrebind
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-iommu-pcidriverrebind
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_IOMMU: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-misc-3
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-misc-4:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/misc') || contains(fromJSON(needs.default.outputs.labels), 'integration/misc-4')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-siderolink
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          VIA_MAINTENANCE_MODE: "true"
          WITH_SIDEROLINK_AGENT: "true"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-siderolink-tunnel
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink-tunnel
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          VIA_MAINTENANCE_MODE: "true"
          WITH_SIDEROLINK_AGENT: tunnel
        run: |
          sudo -E make e2e-qemu
      - name: e2e-siderolink-tls
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-siderolink-tls
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          VIA_MAINTENANCE_MODE: "true"
          WITH_SIDEROLINK_AGENT: wireguard+tls
        run: |
          sudo -E make e2e-qemu
      - name: e2e-apparmor
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-apparmor
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_APPARMOR_LSM_ENABLED: "yes"
        run: |
          sudo -E make e2e-qemu
      - name: e2e-k8s-user-namespace
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-k8s-user-namespace
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH: '@hack/test/patches/usernamespace.yaml'
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-misc-4
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-provision-0:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/provision') || contains(fromJSON(needs.default.outputs.labels), 'integration/provision-0')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: provision-tests-prepare
        run: |
          make provision-tests-prepare
      - name: provision-tests-track-0
        env:
          GRPC_ENFORCE_ALPN_ENABLED: "false"
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          sudo -E make provision-tests-track-0
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-provision-0
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-provision-1:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/provision') || contains(fromJSON(needs.default.outputs.labels), 'integration/provision-1')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: provision-tests-prepare
        run: |
          make provision-tests-prepare
      - name: provision-tests-track-1
        env:
          GRPC_ENFORCE_ALPN_ENABLED: "false"
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          sudo -E make provision-tests-track-1
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-provision-1
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-provision-2:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/provision') || contains(fromJSON(needs.default.outputs.labels), 'integration/provision-2')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: provision-tests-prepare
        run: |
          make provision-tests-prepare
      - name: provision-tests-track-2
        env:
          GRPC_ENFORCE_ALPN_ENABLED: "false"
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          sudo -E make provision-tests-track-2
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-provision-2
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-qemu:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-qemu
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_EXTRA_DISKS: "3"
          QEMU_EXTRA_DISKS_DRIVERS: ide,nvme
          QEMU_EXTRA_DISKS_SIZE: "10240"
          WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml'
          WITH_JSON_LOGS: "true"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-qemu
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-qemu-csi-longhorn:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi') || contains(fromJSON(needs.default.outputs.labels), 'integration/extensions') || contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi-longhorn')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: generate
        if: github.event_name == 'schedule'
        run: |
          make generate
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: checkout extensions
        uses: actions/checkout@v4
        with:
          path: _out/extensions
          ref: main
          repository: siderolabs/extensions
      - name: set variables
        run: |
          cat _out/talos-metadata >> "$GITHUB_ENV"
      - name: build extensions
        env:
          PLATFORM: linux/amd64
          PUSH: "true"
          REGISTRY: registry.dev.siderolabs.io
        run: |
          make iscsi-tools util-linux-tools extensions-metadata -C _out/extensions
      - name: installer extensions
        env:
          EXTENSIONS_FILTER_COMMAND: grep -E 'iscsi-tools|util-linux-tools'
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make installer-with-extensions
      - name: kubelet-fat-patch
        run: |
          make kubelet-fat-patch
      - name: e2e-qemu-csi-longhorn
        env:
          EXTRA_TEST_ARGS: -talos.csi=longhorn
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-csi-longhorn
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_EXTRA_DISKS: "1"
          QEMU_EXTRA_DISKS_DRIVERS: nvme
          QEMU_EXTRA_DISKS_SIZE: "12288"
          QEMU_MEMORY_WORKERS: "4096"
          QEMU_WORKERS: "3"
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH_CONTROLPLANE: '@hack/test/patches/longhorn-cp.yaml'
          WITH_CONFIG_PATCH_WORKER: '@_out/installer-extensions-patch.yaml:@_out/kubelet-fat-patch.yaml:@hack/test/patches/longhorn.yaml'
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        uses: actions/upload-artifact@v4
        with:
          name: fio-integration-qemu-csi-longhorn
          path: |
            /tmp/fio-*.json
          retention-days: "180"
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-qemu-csi-longhorn
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-qemu-csi-openebs:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi') || contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi-openebs')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-qemu-csi-openebs
        env:
          EXTRA_TEST_ARGS: -talos.csi=openebs
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-csi-openebs
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_CPUS_WORKERS: "4"
          QEMU_EXTRA_DISKS: "1"
          QEMU_EXTRA_DISKS_SIZE: "12288"
          QEMU_MEMORY_WORKERS: "4096"
          QEMU_WORKERS: "3"
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH_CONTROLPLANE: '@hack/test/patches/openebs-cp.yaml'
          WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/openebs.yaml'
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        uses: actions/upload-artifact@v4
        with:
          name: fio-integration-qemu-csi-openebs
          path: |
            /tmp/fio-*.json
          retention-days: "180"
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-qemu-csi-openebs
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-qemu-csi-rook-ceph:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi') || contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-csi-rook-ceph')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-qemu-csi-rook-ceph
        env:
          EXTRA_TEST_ARGS: -talos.csi=rook-ceph
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-csi-rook-ceph
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_CPUS_WORKERS: "6"
          QEMU_EXTRA_DISKS: "1"
          QEMU_EXTRA_DISKS_SIZE: "12288"
          QEMU_MEMORY_WORKERS: "8192"
          QEMU_WORKERS: "3"
          SHORT_INTEGRATION_TEST: "yes"
          WITH_CONFIG_PATCH_CONTROLPLANE: '@hack/test/patches/rook-ceph.yaml'
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        uses: actions/upload-artifact@v4
        with:
          name: fio-integration-qemu-csi-rook-ceph
          path: |
            /tmp/fio-*.json
          retention-days: "180"
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-qemu-csi-rook-ceph
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-qemu-encrypted-vip:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-encrypted-vip')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: e2e-qemu
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_EXTRA_DISKS: "3"
          QEMU_EXTRA_DISKS_DRIVERS: ide,nvme
          QEMU_EXTRA_DISKS_SIZE: "10240"
          WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml'
          WITH_DISK_ENCRYPTION: "true"
          WITH_KUBESPAN: "true"
          WITH_VIRTUAL_IP: "true"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-qemu-encrypted-vip
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-qemu-race:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/qemu-race')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: build-race
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
          TAG_SUFFIX: -race
          WITH_RACE: "1"
        run: |
          make initramfs installer
      - name: e2e-qemu-race
        env:
          GITHUB_STEP_NAME: ${{ github.job}}-e2e-qemu-race
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          QEMU_EXTRA_DISKS: "3"
          QEMU_EXTRA_DISKS_DRIVERS: ide,nvme
          QEMU_EXTRA_DISKS_SIZE: "10240"
          QEMU_MEMORY_CONTROLPLANES: "4096"
          QEMU_MEMORY_WORKERS: "4096"
          TAG_SUFFIX: -race
          WITH_CONFIG_PATCH_WORKER: '@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml'
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-qemu-race
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  integration-reproducibility-test:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/reproducibility-test')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: reproducibility-test
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
        run: |
          make reproducibility-test
  integration-trusted-boot:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: contains(fromJSON(needs.default.outputs.labels), 'integration/trusted-boot')
    needs:
      - default
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Download artifacts
        if: github.event_name != 'schedule'
        uses: actions/download-artifact@v4
        with:
          name: talos-artifacts
          path: _out
      - name: Fix artifact permissions
        if: github.event_name != 'schedule'
        run: |
          xargs -a _out/executable-artifacts -I {} chmod +x {}
      - name: ci-temp-release-tag
        if: github.event_name != 'schedule'
        run: |
          make ci-temp-release-tag
      - name: uki-certs
        if: github.event_name == 'schedule'
        env:
          PLATFORM: linux/amd64
        run: |
          make uki-certs
      - name: build
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          PLATFORM: linux/amd64
          PUSH: "true"
        run: |
          make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
      - name: talosctl-cni-bundle
        if: github.event_name == 'schedule'
        run: |
          make talosctl-cni-bundle
      - name: images-essential
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
          PLATFORM: linux/amd64
        run: |
          make images-essential
      - name: secureboot-iso
        if: github.event_name == 'schedule'
        env:
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
          PLATFORM: linux/amd64
        run: |
          make secureboot-iso
      - name: integration-trusted-boot
        env:
          EXTRA_TEST_ARGS: -talos.trustedboot
          GITHUB_STEP_NAME: ${{ github.job}}-integration-trusted-boot
          IMAGE_REGISTRY: registry.dev.siderolabs.io
          VIA_MAINTENANCE_MODE: "true"
          WITH_TRUSTED_BOOT_ISO: "true"
        run: |
          sudo -E make e2e-qemu
      - name: save artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: talos-logs-integration-trusted-boot
          path: |-
            /tmp/logs-*.tar.gz
            /tmp/support-*.zip
          retention-days: "5"
  push:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/')) && github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/')
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: build
        env:
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make talosctl-all kernel sd-boot sd-stub initramfs installer imager talos
      - name: release-notes
        run: |
          make release-notes
      - name: login-to-registry
        uses: docker/login-action@v3
        with:
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io
          username: ${{ github.repository_owner }}
      - name: push
        env:
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make push
      - name: push-latest
        if: '!startsWith(github.ref, ''refs/tags/'')'
        env:
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make push-latest
  tag:
    permissions:
      actions: read
      contents: write
      issues: read
      packages: write
      pull-requests: read
    runs-on:
      - self-hosted
      - talos
    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/')) && startsWith(github.ref, 'refs/tags/')
    steps:
      - name: gather-system-info
        id: system-info
        uses: kenchan0130/actions-system-info@v1.3.0
        continue-on-error: true
      - name: print-system-info
        run: |
          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))

          OUTPUTS=(
            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
            "Hostname: ${{ steps.system-info.outputs.hostname }}"
            "NodeName: ${NODE_NAME}"
            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
            "Name: ${{ steps.system-info.outputs.name }}"
            "Platform: ${{ steps.system-info.outputs.platform }}"
            "Release: ${{ steps.system-info.outputs.release }}"
            "Total memory: ${MEMORY_GB} GB"
          )

          for OUTPUT in "${OUTPUTS[@]}";do
            echo "${OUTPUT}"
          done
        continue-on-error: true
      - name: checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: |
          git fetch --prune --unshallow
      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: remote
          endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
        timeout-minutes: 10
      - name: Mask secrets
        run: |
          echo "$(sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | "::add-mask::" + .value')"
      - name: Set secrets for job
        run: |
          sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
      - name: build
        env:
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make talosctl-all kernel sd-boot sd-stub initramfs installer imager talos talosctl-cni-bundle
      - name: release-notes
        run: |
          make release-notes
      - name: login-to-registry
        uses: docker/login-action@v3
        with:
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io
          username: ${{ github.repository_owner }}
      - name: push
        env:
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make push
      - name: images
        env:
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make images
      - name: cloud-images
        env:
          PLATFORM: linux/amd64,linux/arm64
        run: |
          make cloud-images
      - name: Generate Checksums
        run: |
          cd _out
          sha256sum cloud-images.json initramfs-amd64.xz initramfs-arm64.xz metal-amd64.iso metal-arm64.iso metal-amd64.raw.zst metal-arm64.raw.zst talosctl-cni-bundle-amd64.tar.gz talosctl-cni-bundle-arm64.tar.gz talosctl-darwin-amd64 talosctl-darwin-arm64 talosctl-freebsd-amd64 talosctl-freebsd-arm64 talosctl-linux-amd64 talosctl-linux-arm64 talosctl-linux-armv7 talosctl-windows-amd64.exe talosctl-windows-arm64.exe vmlinuz-amd64 vmlinuz-arm64 > sha256sum.txt
          sha512sum cloud-images.json initramfs-amd64.xz initramfs-arm64.xz metal-amd64.iso metal-arm64.iso metal-amd64.raw.zst metal-arm64.raw.zst talosctl-cni-bundle-amd64.tar.gz talosctl-cni-bundle-arm64.tar.gz talosctl-darwin-amd64 talosctl-darwin-arm64 talosctl-freebsd-amd64 talosctl-freebsd-arm64 talosctl-linux-amd64 talosctl-linux-arm64 talosctl-linux-armv7 talosctl-windows-amd64.exe talosctl-windows-arm64.exe vmlinuz-amd64 vmlinuz-arm64 > sha512sum.txt
      - name: release
        uses: crazy-max/ghaction-github-release@v2
        with:
          body_path: _out/RELEASE_NOTES.md
          draft: "true"
          files: |-
            _out/cloud-images.json
            _out/initramfs-amd64.xz
            _out/initramfs-arm64.xz
            _out/metal-amd64.iso
            _out/metal-arm64.iso
            _out/metal-amd64.raw.zst
            _out/metal-arm64.raw.zst
            _out/talosctl-cni-bundle-amd64.tar.gz
            _out/talosctl-cni-bundle-arm64.tar.gz
            _out/talosctl-darwin-amd64
            _out/talosctl-darwin-arm64
            _out/talosctl-freebsd-amd64
            _out/talosctl-freebsd-arm64
            _out/talosctl-linux-amd64
            _out/talosctl-linux-arm64
            _out/talosctl-linux-armv7
            _out/talosctl-windows-amd64.exe
            _out/talosctl-windows-arm64.exe
            _out/vmlinuz-amd64
            _out/vmlinuz-arm64
            _out/sha*.txt